Posted
by
CmdrTaco
on Monday February 07, 2011 @09:23AM
from the are-you-anonymous dept.

An anonymous reader writes "As the coin was tossed to kick off Superbowl XLV, Anonymous unleashed their anger at a security firm who had been investigating their membership. HBGary Federal had been working on unmasking their identities in cooperation with an FBI investigation into the attacks against companies who were cutting off WikiLeaks access and financing. Unlike the DDoS attacks for which Anonymous has made headlines in recent months, this incident involved true hacking skills."

Agreed. In fact, this battle was lost before it began. The world had settled on the word "hacker" before the word "cracker" was invented. Plus, "cracker" is a racial slur. There's even a damn movie called "Hackers". It's long since time to let it go.

Plus it's misleading to separate the two. It's like saying that shooting beer cans off a fence is shooting, while shooting another person is not shooting, but murdering. You can understand why the beer can plinkers don't want to be associated with the gangbangers, but coming up with a "new, stronger word" for shooting people is just intellectually dishonest.

Actually there happens to be an applicable word for that - it's called "plinking".

Your point is a good one, though. The fight to keep the meaning of the word "hacker" pure is lost, and has been for some time. I think, though, that given context and knowledge of who's using the word about whom, we'll still be able to use it the way we always have ("Put a 3.2 GHz Phenom into your Linksys router? What a hack!") and let the rest of humanity use it however they will.

The only place where two wrongs make a right is boolean algebra. Revenge/retaliation just continues a cycle of aggression and destruction. I'm hardly happy about extraordinary rendition either. Whatever Anonymous' valid claims may be, this does nothing for their cause, except to give themselves hugely negative publicity. Way to go, generate sympathy for those you are against... sheesh.

Things like this might be more of a "blood knight" thing, though. E.g., whomever did this might find it primarily fun to hack a security firm, and only being secondarily motivated by some ephemeral "venegance".

Defacing a website and causing data loss is the same thing as torturing someone to death, or subverting democracy to keep an autocratic regime in power? That's news to anyone with an elementary understanding of ethics.

Seems a perfectly reasonable response to me. HBGary tried to out members of Anonymous; exposing their private information. Anonymous returned the favour. In the arena of public opinion, Anonymous are ahead. HBGary were made fools of.

But to talk about "aggression", "destruction" is silly. Actually in BOTH CASES the only ones at risk of real harm are Anonymous. If members of Anonymous are actually tracked down, they would get chewed up by the legal system.

It's amazing how many people don't understand this. "Anonymous" is as smart or as dumb as whichever person wants to ascribe their current actions to anonymous. And the more you have a "fight against anonymous", the more you make it real. It's like a self-fulfilling fiction...someone makes it up, people hear about it, decide they want to be a part of it, and make it real, even though it was never real to begin with. Also [xkcd.com].

But that's what makes it funny -- people have trouble even comprehending the idea of something that kinda functions as though it were an organization on the outside, but is instead a largely chaotic swarm people who enter and leave seemingly at random, with no real leadership or formal direction, beyond someone painting a target and inciting the great swarming mobs of the internet to attack it.

Hence the whole "We are Anonymous. We are legion. We do not forgive. We do not forget." It is an accurate descr

Helpful to whom? To you? To me? To the company which was targeted? To anons? To cops?

Helpful to anon and their cause. The problem is that this isn't.

Fucking around on a telecommunications network is not an exercise of real power. All it does is demonstrate how truly impotent Anonymous really is, while simultaneously giving those who do have real power excuses to further restrict use.

Ultimately, this is a political issue. The little guy wins at politics only through sheer force of numbers. That means being popular. I understand that "popular" is a word that Anon's members probably have a hard time identifying with, but it's one they really need to take and use for their own if they want to achieve their goals.

Anonymous needs to be appealing. It needs to be photogenic. People should want to have sex with it. That's how the world works: People do not clearly separate moral principles, from political goals, from personal desires, from sexual urges, from the respect of their peers. Study after study has shown, for instance, that people with more attractive faces are judged to be more honest; "beauty is good" is wired into our brains. When was the last time you saw a balding man, or a short man, elected president? Anonymous will not succeed if it looks like a bunch of smelly nerds. It needs a better image. People need to like them.

Assange, the paranoid, has an uphill battle; he is not a naturally likeable person. But he did one smart thing: When he found himself in the limelight, he got a haircut and bought a suit. That's what you do.

In politics, image is everything. Do you know how George Washington got the command of the Continental Army? He showed up to the Congress wearing his militia uniform -- and he was tall. Nevermind that he had no military experience of note; he looked the part. Why are actors -- unqualified in policy and unpracticed in analysis -- so successful at politics? Ronald Reagan, Jesse "The Body" Ventura, Arnold Schwarzenegger. They play a convincing, masculine role. People eat that shit up.

This is the game that Anonymous finds itself playing, whether it likes it or not. Image management is how you win at it.

When was the last time you saw a balding man, or a short man, elected president?

1) Balding: Gerald Ford.
2) Short: Jimmy Carter.

Neither were the first.

(More interestingly, prior to the Civil War, for what heights were known, a man was more likely to be elected if he was not the tallest candidate. Perhaps that was because the electorate was not as superficial in that era. Interesting pattern given the demographic changes to enfranchisement over time, but I am not prepared to draw conclusions without further research.)

Not sure why you were modded as funny.You never know, they might have been pretty dumb, or careless somewhere. And even if they were behind proxies, that doesn't make it impossible to trace them either. I suppose it depends on who was running the proxies, where they were (and therefore what laws are in effect), and how cooperative the involved ISPs are.

These guys have been watching whats going on, following what they've been doing, and are working with the FBI... do you really think no one thought in advanced 'hey, when we piss them off, they'll come after us too!'

No... they thought of it in advanced and said 'perfect, now lets set it up so we can have it setup in a perfect way for us to gleen the absolute most information in the process.

Anyone stupid enough to do this isn't a major player anyway, or won't be for long. They basically just started a war with the cops, the only thing you can do to piss off a cop more than embarrassing them is killing one of them. So now they've changed it from being an annoying bunch of twits who don't really do any damage and no one is going to invest any serious effort into finding... into a matter of personal pride for every person working on it. They also have the advantage of funding and not having to cower in mommies basement.

This just shows the ignorance 'anonymous' has...

If you'd have payed attention in school you'd know mob justice isn't a good idea, perfect example here.

HBGary Federal CEO: How can we catch anonymous?HBGary Federal 1: How about we ask employees to use the same password everywhere, let them attack us and catch them in the act?HBGary Federal CEO: Great idea, what should we use as bait?HBGary Federal 1: How about all our emails including your social security number?HBGary Federal CEO: Perfect, make it happen.

I work for a telecom dealer that specializes in fulfilling corporate needs. All corporate sales are done through our website. A few of our clients are security companies. One of them (which will go unnamed) has a key purchaser who is completely computer illiterate. When trying to troubleshoot her difficulties using our website, I asked what browser she was using. She replied "Office 2003".

After patiently instructing her on how to determine her browser and version number, it turned out she was using IE6. That was about 2 years ago. They still use IE6 to this day and have no intentions of switching off of it. Having dealt with a large variety of companies over the years, I think security firms are the most technically inept and the most likely to completely disregard online security.

I work for a telecom dealer that specializes in fulfilling corporate needs. All corporate sales are done through our website. A few of our clients are security companies. One of them (which will go unnamed) has a key purchaser who is completely computer illiterate. When trying to troubleshoot her difficulties using our website, I asked what browser she was using. She replied "Office 2003".

After patiently instructing her on how to determine her browser and version number, it turned out she was using IE6. That was about 2 years ago. They still use IE6 to this day and have no intentions of switching off of it. Having dealt with a large variety of companies over the years, I think security firms are the most technically inept and the most likely to completely disregard online security.

I think the problem is "risk analysis". It's the latest project management buzzword circling Corporate America, but the ones tasked with doing it have no idea what they're really doing, or what the risks really are.

They'll put together a meeting to answer the question "what is the risk if we change everyone to IE8?" People in a conference room will toss out reasons like "It will break our internal web site, costing $50,000 to fix." "It will break compatibility with our trading partners, costing us $20,000

These guys use botnets, proxies, vpn tunnels, whatever it needs to obfuscate their origins. Don't be surprised if the feds come knocking on the HBGary owner's door, claiming the IP address traces back to his home PC.

So do a lot of other hackers. They still get caught. If the feds can track down the origin of a virus, they can find whoever did this. You'd think that the guy who got into Palin's email account would have done the same, but the idiot used a single US-based proxy.

Erm, wouldn't that involve every ISP in the world having to keep record of ALL IP traffic? And you probably have to count in records of open wireless connections and internet cafe's and such. Plus, considering that end-to-end ecryption is being used, they would have to know security details of nodes involved. It's not even plausible.

yes.. but in those deep pockets are their own hands firmly grasped around their own dicks..

That is a list of stagnating unintelligent grunts who have only got where they are by buying other peoples work and then aggressively maintaining their monopolies by force (through the medium of money, collusion, corruption and occasional broken legs). The only name there worth technical s**t is Amazon.

It's hard to know how to feel about someone waging war against your own society.

Anonymous is fighting partially on behalf of Wikileaks. Wikileaks' recent releases put some sunlight on goverment/industry malfeasance, but also pointlessly harmed some diplomatic efforts by publishing unflattering personal opinions about people the US probably needs to get along with.

And the company Anonymous is going after probably helps stop real security threats that most of us would agree merit stopping; not just Cablegate-related stuff.

And the company Anonymous is going after probably helps stop real security threats that most of us would agree merit stopping; not just Cablegate-related stuff.

To help you out: HBGary is still running. HBGary Federal is a new spin-off company started in December 2009 to try and sell "cybersecurity" products to the Feds.

If they were cybersecurity experts, ones that were worth paying for with your tax dollars, then Anonymous would not have been able to pwn their website, twitter accounts, email,....

According to some of those recently pwned emails, the spokesperson Aaron Barr admitted to his own staff that he was deliberately provoking Anonymous, because he knew that the press was interested in anything to do with Anonymous and they'd get good publicity and possibly sales.

The money quote from Aaron's company email: But it's not about them... it's about our audience having the right impression of our capability and the competency of our research. Anonymous will do what every they can to discredit that. and they have the mic to speak because they are on Al Jazeera, ABC, CNN, etc. I am going to keep up the debate because I think it's good business, but I will be smart about my public responses.

A good security firm doesn't lock down everything super tight. It can be done of course, but doing so is a major inconvenience. A good security firm knows how to manage risk, and apply enough security to outweigh the risk. As if any of those things that got "pwned" are of any real consequence.

This is the equivalent of someone running up and spray painting the side of an armored truck and declaring victory in defeating their security. lol.

Or perhaps calling into question how safe a bank is because someone stole their mailbox.

Wikileaks has done effectively nothing recently besides attack the US government. Where's all those high-finance leaks that were promised years ago? Where's the responsible redaction that every reputable journalist goes through? Where's the public editing and input that it began with? As far as I can tell, Wikileaks lost all attempt at virtue by the beginning of 2010. Since then, it's resorted to blackmail to maintain its interests, threatening to release unfiltere

I like the USA. I'm a fan. It's done some good things in the past and it's a pretty good model for how to run things. On the whole, people here are more free and more prosperous then people elsewhere. But I like the USA because we're the good guys. When it was us vs. the NAZIs, it was pretty obvious who was the bad guys. I mean, they invaded countries and were conquerors. And while we really screwed over the local Japanese, the Japanese empire was really brutal.When it was us vs. the Soviets, it was more or

I wish I had mod points to use on your post. "...I like the USA because we're the good guys." And if we're not the good guys (ie, if people in the government are making "bad guy" decisions) then people need to know about it and it needs to be fixed. Taking the high road is never fun, but having that integrity as a nation just seems like an important goal.

I'm in agreement all the way up to that point. Is it virtue to set someone on fire if they're freezing to death?

My complaint isn't with the idea behind Wikileaks. I'm all for a transparent government, where it's necessary. I don't believe it's necessary to have every detail of daily military action paraded out for enemies to see, whether or not the war was justified. What I want to see is responsible redaction, impartial releases, and input from the public on every released item. So far, Wikileaks has faile

I recall hearing about an "upcoming" Bank of America leak as one of Wikileaks' first projects. Apparently it's become a bigger deal in the past few weeks, but I'm not going to hold my breath.

The Cablegate documents still had exact names, places, and times included. It's enough to easily reveal cover identities for traveling VIPs, common itineraries, and political opinions that are supposed to remain private for diplomacy to work. Competent sanitizing requires removing not just things that look risky, but al

If these Anons are, as we are led to believe, under the age of caring, why are these actions deemed so wrong? Shouldn't they be seen as the only appropriate action?UK and US children have known nothing but war since they day they were born. Sadam makes a threat, we bomb him. Sadam does a naughty, we bomb him. Bomb on planes and trains, we carpet bomb someone.

And we expect our own offspring to behave themselves when faced with authority?

I think we're asking too much of them. Until our own actions change, vir

You really have to define "your own society" in clear terms to work this little moral conundrum out...

Wikileaks, and their anonymous friends, are definitely attacking the secrecy of certain state and corporate entities that exist on American soil and/or are paid for with US taxpayer funds. Is that enough to make them "our own society"? Or does the fact that a clandestine morass of opaque state functionaries, often quite a few levels removed from anything resembling a "representative" is dubiously in line with a democratic republic make them a sort of cancerous outgrowth of "our own society"?

I'm not playing the "Well, man, it's like, all relative; because one person's hero is another's terrorist, man." card. These are real questions that, arguably, have cogent answers(albeit ones reliant on certain axiomatic assumptions that the answerer brings to the table).

Societies constantly attack themselves in order to survive: the police spend basically all their time hunting down and hauling in for trial citizens and residents whose behavior is considered to have put them against society rather than in it. Politicians constantly attack one anothers' programmes, in a process intended to produce the best or most representative outcome. Assorted NGOs and individuals constantly bring suits against one another and the state trying to redress various perceived wrongs. As with a complex multicellular organism, where killing abberant cells before they metastasize and kill you is as important a job as killing external pathogens before they kill you, the maintenance of a complex society is a constant process of defense from external enemies and(particularly for a militarily strong and geographically lucky country like the US) culling internal enemies and dangerous trends.

Unless we define "our society" more or less tautologically as "whatever society we are participating in at the moment"; it is the case that there is an ideal "our society" and an actual "the society we are doing". When the two differ too much, "our society" becomes a dead letter, used primarily for propaganda purposes by "the society we are doing". Fighting against that trend, which frequently means attacking, sometimes in accordance with the rules of "the society we are doing"(as with constitutional challenge court cases), sometimes against those rules(leaks, hacks, etc.) "the society we are doing", is a necessary part of staying reasonably in line with "our society".

It is a matter of legitimate debate whether or not Wikileaks is attacking "our society" or "the society we are actually doing", and how different those two are; but it is not a matter of trivial debate.

Well, I don't know about the revelations being pointless (although in the end I think they'll be largely harmless), but that has little to do with the ethics of Wikileaks. Reportedly Assange was initially indifferent to the risks the Iraq War Logs posed to civilians who may have talked to US forces, dismissing them as "collaborators". I've certainly heard his supporters taking this blanket position. This is really just the mirror image of George W. Bush's "you're with us or against us" way of looking at thi

Federal pound you in the ass prison.
Seriously... It may be a laugh riot for the mob of 15 year old script kiddies to thumb their pimply noses at the suits and squares, and hide behind a "we r legion, lutz!"... but with any criminal conspiracy, the actions of one of the members all are attributable to the rest. All it will take is a few supoenas, some jail time for a few members, and anonymous will go away.
No, for reals, yo. It's real brave to participate in a ddos when they can't fathom any consequences

And I really do hope they get away with it...kinda like LeoDi's character in "Catch Me if You Can", but these things generally end up badly for the bad guys when things start to go public like this. HBGary will probably hire someone who actually knows his shit and tack them down; eventually someone will screw up and put a decimal in the wrong place or some mundane detail like that.

Civil Disobedience is, as far as I know, marked by breaking unjust laws, and then *accepting the consequences* by going to jail, or whatever, to show society the unjustness of the laws, and to win sympathy to your cause.

I believe Anonymous stepped way over the line of Civil Disobedience long ago, with retaliation upon retaliation and attempting to avoid being caught. I really just have to view Anonymous as largely a group of criminals who deserve to be in jail for engaging in openly criminal activity - I ca

The myth of 'Civil Disobedience is all about getting caught' is spread by those who don't like the goals of today's civil disobedience, only those of yesterday.

"Under a government which imprisons any unjustly, the true place for a just man is also a prison."

That's from Thoreau's Civil Disobedience essay. He refused to pay his taxes because of slavery and the war with Mexico. He was sent to jail, but ended only spending a day because somebody paid his taxes for him.

Whether you agree with him or not, that's the root of Civil Disobedience. It is true that he didn't say that you should go out of your way to be caught, but he was also willing to go to prison rather th

Blacks in America sat in whites-only establishments in direct contravention of an unjust law -- they broke laws of segregation in order to highlight to the public the systemic injustices placed upon black Americans. What law is Anon directly disobeying to highlight its injustice? All they've broken are laws against computer fraud and abuse. What injustices within computer fraud laws does that highlight? I can understand if Wikileaks mirrors were shut down or reading WL material were made forbidden to the public, and individuals come together to help each other set up servers and to access them in defiance of government censorship. You could draw an equivalence if that were to happen, but what Anon is doing right now is NOT the same as civil rights era civil disobedience.

I suspect that neither Wikileaks nor Anonymous are interested in engaging in "Civil disobedience".

In the case of Wikileaks, they aren't "Civily disobedient"; because they don't actually tend to break laws. They do obviously have some contact with people who do; but their operations(while deeply unpopular) are not illegal.

Anonymous, on the other hand, is perfectly happy to do illegal things; but doesn't seem to see the point in getting punished in an effort to maintain the moral high ground. They are(aside from the ones who are in it purely for amusement), essentially engaging in the logic of retributive or revolutionary violence, albeit in bloodless and electronic forms. Irregular resistance fighters have no interest in being caught to "generate sympathy", they have an interest in inflicting damage on strategic targets, obtaining intelligence, discrediting their enemies, and then getting away(so do criminals, of course. The classification depends on the percieved legitimacy of their actions).

As you say, these guys are definitely not in the same class as the followers of Ghandi or MLK. This appears to be by design. Wikileaks, by all appearances, is interested in maintaining a legal operation to lower the cost of whistle-blowing in situations where that could open one to heavy retribution. Anonymous, while too nebulous to have a single agenda, consists of a sort of core that has embraced the logic of violent(but bloodless) direct action, along with a cloud of recreational me-toos who participate in some of the more trivial ops.

Whether you think that this is good, bad, or just a matter of style is a different question; but it would appear that they are not aiming at "Civil disobedience"(having judged it as either too personally costly, too ineffective, or perhaps both)...

While an ideal attribute, civil disobedience is often weak tea. If someone who is protesting something unjust, has to take all the risks to bring about a level playing field, it often just does not work. Unless a HUGE number of people are involved, it does not work.

Take the protests in Egypt, Mubarak has been president for 30 years! He has ruled completely for that time. It is taking over 2 million protesters showing up at once to even make a grudging change at all. And there is no guarantee that any of

I saw someone compare a DDOS to picketing, which is legal in some countries. I have no idea what the laws are in the various countries involved, but the question is like this: assume I don't like a store, and I go in front of it and try to stop people from going in. If that is legal (with certain conditions), than what type of action am I allowed to take against websites?

At least in the US, picketing is legal if you do not prevent people from going about their business. As soon as you prevent people from going into the store, or keep workers from crossing the picket line to get to their job, etc. then that's illegal.

Basically, picketing is based on the concept of free speech, and protected by the First Amendment. March up and down all you like, on the public sidewalk in front of the store, or in other public areas. Carry your signs, chant your slogans, that's all protected

Normally, I would agree with you, but the DDoS, in particular, upon the credit card companies was an organized, concerted effort by a *group* of people all working together. They all communicate together in a common forum (4chan). They aren't acting individually, they are acting corporately.

There was no FBI involved in this. It was some random company's attempt at PR (I'm sure they regret it now). The original article even says that the information would not be useful to police and that they planned to give it away at a conference in San Fransisco next week.

Not exactly "cooperation with an FBI investigation"

Seriously Slashdot... when are you going to hire editors who actually verify submissions before letting them onto the front page. No better than the national enquirer...

If the hackers were UK based then they just have to buy a wireless dongle. You just lie about the information on the registration screen and away you go untraceable. Granted they will be able to triangulate the signal but its easy enough to drive somewhere quiet with a laptop and do it.
Failing that they could just hack some poor old ladys wireless and use that.
Both of these options are simple to do and less hassle than proxys.

The UK? The poster child of Big Brother is watching you with CCTV? They can only triangulate your position at a particular point in time? What's to stop them from say... looking at the CCTV footage at the particular point in time? Not only could they have a picture of you but then follow the footage of you though out the day. Who cares if you fibbed about your identity on the login screen. Eventually you have to go home or talk to friends and they'll see that.

Good security is too inconvenient for the typical business person. Easy security is invariably bad security. "We want to work from home or the coffee shop and not have to remember stupid passwords!" Tough!

This is especially bad when this is supposed to be a cyber-security focused company! If I were in a decision-making position in the FBI, I would simply walk away from this company without another word. This company is clearly not up to the task of defending itself. How can they be trusted to do good research and deliver good information?

Why is it that when the government(s) refuse to listen to their people, the people get angry? Why is it that governments don't understand or appreciate that this is no small matter? And isn't it a terrible sign that when a people begin acting out against the government and parties involved that the government closes up even tighter refusing to hear anything at all? The result of this behavior is ALWAYS the same -- the angry people get even more angry and will push back even harder.

Wouldn't it be more responsible for the government to at least open up some talks before things get like this and worse? No... I know that won't happen. "We don't negotiate with terrorists!" Fine. Who WILL you negotiate? They wouldn't be "terrorists" if you didn't listen and respond!!

So, Americans decide to peacefully toss a few sacks of tea into Boston harbor and get the entire harbor shutdown.. so they counter with even more illegal activity and a revolution that will get them even further into the shit

great plan numbnuts

Point being... if everyone on Earth was afraid to break a few laws, we'd still be under the rule of British monarchs. Thank god some people don't tuck tail and run whenever Big Brother stares in their direction.

Troll? Really? What he said is a fair comparison, AND the situation is similar. The folks throwing the tea overboard were arguing against unfair taxation without representation. These guys, however potentially misguided at times, are fighting for what they believe is the protection of free speech, which is one of the CORE ideals of the same people that threw the damned tea overboard.

Some people around here need to grow a damned backbone, and a set of common sense. Regardless of that however, -1 Troll is not

Anonymous has been "fighting for free speech" for years by trying to hand opportunistic politicians a reason to crack down on it for YEARS. Posting CP to 4chan? Yeah, that'll do it! Raiding people, such as grieving family members by sending them pictures of their car-crashed dead? Yeah, that's a great move for free speech! Hacking Facebook accounts so they can send everyone on a friend's list scat porn? Yay for free speech! Then there's the Palin email "hacker", a guy who hardly turned out to be a free spee

Actually this was probably a brilliant idea on their part. They just tainted the evidence against them. They deleted the companies backups and had access to the only copy of the data. So now the data is completely inadmissible in court.

I don't know why people act as if "Anonymous" is a new thing. It's not. It's just a present-day version of something ancient - the lynch mob. The mob doesn't think, the mob doesn't consider, the mob just destroys. The mob is the barbarian horde burning down civilisation.

For a historical example of an earlier "Anonymous", think about the KKK. Just why did they wear those white hoods? The answer is easy. They did it to be "Anonymous", because if you are "Anonymous", you are released from the obligation to be a civilised human. You do what you like without consequence, so why not lynch a few negroes before they get uppity?

but the government acting out is just an act of defiance to accept theiraccountability in this....and that only leads to more....so US gov. please accept that you did some wrong, and should maybe pull back

There's approximately a 0% chance that will happen. No, the government operates pretty much along the same lines that you described: screw with us, you get burned. Retaliation leads to more retaliation. The situation will escalate until the government makes participating in raids uncomfortably risky or the teenagers get bored.